Privacy Policy

When you create an account we collect your email address and, optionally, your name. When donors use a spon.to page we collect the donation amount, currency, and payment metadata returned by the payment processor. We do not store full card numbers.

We collect basic analytics data (page views, referrer, country) to help organizers understand their audience. This data is aggregated and not tied to individual identities.

Your email is used to authenticate your account and send transactional messages (password resets, important service updates). We do not send marketing email without explicit opt-in.

Payment data is processed by Stripe and subject to Stripe's Privacy Policy. spon.to only receives confirmation of successful payments and the amount.

We do not sell your personal data. We share data only with the third-party services necessary to operate the platform (Stripe for payments, Vercel for hosting, PostgreSQL for data storage). All providers are contractually bound to handle your data securely.

Account data is retained for as long as your account is active. You may request deletion at any time by contacting us. Deleted account data is purged within 30 days, except where we are legally required to retain records (e.g. financial transactions).

We use a single session cookie for authentication. No tracking or advertising cookies are set. We do not use third-party analytics that fingerprint individual users.

Depending on your location you may have the right to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise these rights contact us at privacy@spon.to.

We may update this policy from time to time. When we do we will update the date at the top of this page. Continued use of the service after changes constitutes acceptance of the revised policy.